IAEA Nuclear Security Series (NSS) is the family of publications providing internationally agreed guidance on nuclear security developed in consultation with Member States. NSS-17 Computer Security at Nuclear Facilities (Technical Guidance Reference Manual, original December 2011) was the foundational Implementing Guide; superseded by NSS-17-T Rev 1 modernisation and complemented by NSS-42-G Computer Security for Nuclear Security (Implementing Guide, 2021) which expanded scope beyond facilities to cover the full nuclear security regime including material in transport + radioactive sources + material out of regulatory control. NSS family categories: Nuclear Security Fundamentals (objectives + concepts + principles); Recommendations (best practices for Member States); Implementing Guides (further elaboration of Recommendations); Technical Guidance (Reference Manuals + Training + Service Guides). NSS-17/42-G apply to: national authorities + operators of nuclear facilities (Nuclear Power Plants NPPs + research reactors + fuel cycle facilities) + radioactive material associated facilities + material out of regulatory control. Computer Security Programme (CSP) establishment: senior management commitment + dedicated computer security function + competent authority designation + reporting line to senior management; policy statement + objectives + scope + commitment to continuous improvement; integration with overall facility management system (Quality + Safety + Physical Security + Emergency Preparedness + Information Security per NSS-23-G); roles + responsibilities + competencies + RACI for: operator + State + Regulatory Body + designated competent authority + national CSIRT + intelligence + law enforcement + IAEA. Coordinates with International Convention on Physical Protection of Nuclear Material amended (CPPNM/A) + Code of Conduct on Safety and Security of Radioactive Sources + UNSCR 1373 + UNSCR 1540 + International Convention for the Suppression of Acts of Nuclear Terrorism. IAEA NSS-17 + NSS-42-G + Computer Security Programme + management system + roles applies.
This control maps to 21 controls across 15 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 21 it maps to, and the evidence behind each claim, over MCP and REST.